v154 · security · developer tool

HTTPS migration toolkit

If your site is HTTP-only, Chrome 154 now asks visitors whether they really want it. The fix has two halves: redirect every http request to https, then tell browsers to stop trying http at all with Strict-Transport-Security. This tool builds both, validating the HSTS header against the real preload-list requirements as you type.

1 · Build the HSTS header

2 · Generate the 301 redirect


    

      
      
    

  


  

    
3 · Ship it in the right order

    
    
      
  1. Serve everything on https with a valid certificate; fix mixed content (see the subresource lab).
    2. 
      
  2. 301-redirect http → https (step 2). Redirect before HSTS: the header is only honoured over https.
    3. 
      
  3. Add HSTS with a small max-age, watch, then raise it. Note there is no path scoping — HSTS is host-wide by design.
    4. 
      
  4. Only add preload + submit at hstspreload.org when you are sure: removal from the shipped list takes months, and it commits every subdomain.
    5. 
    

  


  
see also